FCP Testing and Quality Assurance 2 — Questions and Answers
Question 1: Which FIDO2 test tool is used to verify authenticator conformance before submission to the FIDO Alliance?
- FIDO Conformance Test Tools (CTT) (Correct answer)
- OpenSSL test suite
- WebAuthn Debugger CLI
- CTAP Simulator SDK
Correct answer: FIDO Conformance Test Tools (CTT)
The FIDO Conformance Test Tools (CTT) are the official tools provided by the FIDO Alliance to verify authenticator and server compliance.
Question 2: When testing a FIDO2 authenticator's resident key (discoverable credential) functionality, what is the primary concern?
- Ensuring the credential is stored on the authenticator and can be listed without a prior user ID (Correct answer)
- Verifying the public key is exported correctly to the server
- Confirming the PIN length meets minimum requirements
- Checking that the attestation certificate chain is valid
Correct answer: Ensuring the credential is stored on the authenticator and can be listed without a prior user ID
Discoverable credentials (resident keys) must be stored on the authenticator so the relying party can authenticate without supplying a credential ID.
Question 3: A QA engineer notices that an authenticator returns an aaguid of all zeros in its attestation. What does this indicate?
- The authenticator is using self-attestation and concealing its model identity (Correct answer)
- The authenticator failed the FIDO conformance tests
- The credential was created in CTAP1/U2F mode
- The attestation certificate is expired
Correct answer: The authenticator is using self-attestation and concealing its model identity
An all-zeros AAGUID indicates the authenticator is using self-attestation, intentionally hiding its specific model identity.
Question 4: Which test scenario specifically validates that a relying party rejects a registration response where the clientDataJSON origin does not match the expected origin?
- Origin binding validation test (Correct answer)
- Attestation trust path test
- User presence flag test
- RPID hash mismatch test
Correct answer: Origin binding validation test
Origin binding validation tests confirm that the server rejects registrations where the clientDataJSON origin differs from the expected relying party origin.
Question 5: During CTAP2 interoperability testing, a tester sends a makeCredential command with an unsupported algorithm in pubKeyCredParams. The expected authenticator behavior is to:
- Return CTAP2_ERR_UNSUPPORTED_ALGORITHM (Correct answer)
- Silently ignore the unsupported algorithm and proceed
- Return CTAP2_ERR_INVALID_CBOR
- Close the transport connection
Correct answer: Return CTAP2_ERR_UNSUPPORTED_ALGORITHM
CTAP2 specifies that authenticators must return CTAP2_ERR_UNSUPPORTED_ALGORITHM when no algorithm in pubKeyCredParams is supported.
Question 6: What is the purpose of testing the 'up' (user presence) flag in the authenticator data during QA for a FIDO2 implementation?
- To confirm the authenticator required a physical user interaction before signing (Correct answer)
- To verify the user's PIN was correctly validated
- To ensure the credential counter was incremented
- To check the attestation format is packed
Correct answer: To confirm the authenticator required a physical user interaction before signing
The 'up' flag in authenticatorData must be set to 1 to confirm that a physical user gesture (touch or button press) occurred before signing.
Question 7: A test case verifies that an authenticator correctly handles the 'exclude list' in a makeCredential request. What should the authenticator do when a credential in the exclude list is found on the device?
- Return CTAP2_ERR_CREDENTIAL_EXCLUDED and not create a new credential (Correct answer)
- Overwrite the existing credential with a new one
- Return success but include an error flag in the response
- Prompt the user to approve replacement of the existing credential
Correct answer: Return CTAP2_ERR_CREDENTIAL_EXCLUDED and not create a new credential
When a credential matching the exclude list is found, the authenticator must return CTAP2_ERR_CREDENTIAL_EXCLUDED to prevent duplicate registrations.
FCP Testing and Quality Assurance 2
Which FIDO2 test tool is used to verify authenticator conformance before submission to the FIDO Alliance?